Draw the phone, the network and the backend, and assume the device itself can be hostile. Then check five areas: local data storage, network transport, deep links, authentication, and app integrity. OWASP's mobile guidance and the MASVS control groups give a ready list to test each against.
Draw what is different about mobile
A web app runs on your server. A mobile app also runs on a device you do not control. Your diagram needs a trust boundary around the device, another between app and network, and a third at the backend. The OWASP mobile cheat sheet says to assume all network communication is insecure and can be intercepted.
Five areas and what to ask
| Area | Question for the model | Guidance from OWASP |
|---|---|---|
| Data storage | What sensitive data lands on the device? | Encrypt at rest, use internal storage and platform APIs, guard against leakage through caches, logs and background snapshots |
| Transport | What if the network is hostile? | Use HTTPS, do not override certificate validation, consider pinning |
| Deep links | Can a link reach a screen without a login? | Check authentication on screens reached by deep links, validate parameters, use Universal Links |
| Authentication | Where is the decision made? | Do it server side, do not store passwords on the device, use session timeouts and re-authentication for sensitive actions |
| App integrity | What if the app is modified or hooked? | Disable debugging, validate integrity, add runtime anti-tampering checks |
The cheat sheet cites a real case where a deep link bypassed an app lock, which is why deep links get their own row.
Use MASVS as a second list
The OWASP MASVS groups requirements into eight areas: storage, crypto, authentication and authorization, network communication, platform interaction, code quality, resilience against reverse engineering and tampering, and privacy. After your STRIDE pass, walk these eight and note any area you did not cover.
What to record
For each threat note whether the control lives on the device or the server. Controls that only live on the device can be removed by an attacker who owns the phone, so important decisions should be checked again on the backend.
Quick check
Is certificate pinning always needed?
The OWASP guidance says to consider it. Whether it is worth the operational cost depends on your data and your threat model, so record the decision either way.
Can I rely on root or jailbreak detection?
OWASP lists detection as part of anti-tampering, but treat it as a speed bump. A determined attacker controls the device, so keep key decisions on the server.
A note on tooling
Threat modeling your own app is a design task. For the app dependencies, SBOM and dependency scanning plus reachability analysis apply, and there is a free scan.
Sources
Last reviewed: 19 October 2026.
